Small Businesses Can Run Professional Email on Aliases Alone

I run AliasFleet, an email-alias service built around one address per relationship. A small business does not need an IT department to run its email like a grown-up operation. A handful of role and vendor aliases gives you leak attribution when a vendor spills, clean handoffs when someone leaves, and spam that stays fenced to one address.

The setup most small businesses actually have

Here is what I see most often. The owner registers a domain, buys one Google Workspace or Microsoft 365 seat, and puts their own name on everything: the invoices, the contact page, the footer of every quote. One address, and it is their name.

It works until it does not. The address ends up on every supplier list, every directory, every newsletter signup, every "just drop us your email for the whitepaper" form. The spam starts. Then the owner hires someone and the new hire needs the same threads, so the password gets shared. Then someone leaves, and nobody is quite sure what they still have access to. That is the usual path. No dramatic hack required.

Shared passwords are the specific habit that quietly ruins everything. SQ Magazine's small-business security guide puts it plainly: small businesses get hit because they have no IT department, shared passwords, and a few people handling everything. Response I.T. makes the mechanism explicit: when staff share passwords, a departing employee keeps knowing credentials that everyone else still uses, long after their own account is gone.

The fix is not more staff. It is fewer addresses that mean something.

Role addresses outlast the people in them

A role address is an address that describes the job, not the person: orders@, billing@, hello@, support@. Customers learn it, print it, and bookmark it. When the person handling orders changes, the address does not. You reassign the alias and nothing printed on your packaging ever goes stale.

This is the part most owners do not realise. They already paid for this. Google's setup FAQ says it directly: you do not need to buy user accounts for role addresses. Email aliases and group addresses are free and do not count toward your licenses. An alias suits one person: messages to info@ land in your own inbox. A group suits a team: everyone in sales sees mail to sales@. On Microsoft 365, you add them as proxy addresses on the mailbox, about two minutes per address by Microsoft's own estimate.

A table like this is the whole starter kit:

Address	Purpose	Who reads it
orders@	Quotes, purchase orders, delivery queries	Whoever handles fulfilment this year
billing@	Invoices in and out, payment questions	Whoever does the books
hello@ or info@	The address on the website and the van	You, or whoever answers first
listings@	Directories, trade shows, lead magnets	You, with a filter for the noise

Four aliases. One paid seat. Nothing shared, nothing renamed when someone leaves. That alone fixes the turnover problem that TeamPassword flags: employees keep credentials because everything was tied to people instead of roles. Tie the address to the role and there is nothing to take with them. (The team-side mechanics, offboarding checklists and shared-mailbox comparisons, are a separate story.)

Give each vendor its own address

This is where it gets interesting for the owner. Give every vendor you pay regularly their own alias: acme-paper@yourdomain, or a proper alias like vendor-acme@ if your provider allows it. The mail still lands in your inbox. But now the address carries information.

When spam or a phishing lure arrives addressed to the alias you gave exactly one vendor, you know which of your vendors leaked, sold, or got breached. That is leak attribution without any software. Which website leaked my email walks through the same trick on the consumer side; for a business, the stakes are higher because your vendors hold your payment correspondence.

The reason this matters more than people think: your vendors are the weakest part of your setup, and you cannot audit them. The Verizon 2025 breach report, as analysed by DuoCircle, found that 30 percent of breaches now involve third parties, double the figure a year earlier. SecurityScorecard's own research puts it more starkly: 98 percent of organisations have a relationship with at least one breached third party. So yours probably has too. You cannot stop your paper supplier from getting breached. You can make sure the address they hold is theirs alone, so the fallout ends at that one alias.

I do not know which of my vendors will be breached next. Nobody does. But I know exactly which address I handed each one, and that is the part I control.

Role addresses cost nothing on Google Workspace or Microsoft 365. Per-vendor aliases are where a dedicated alias service earns its keep: granular addresses with pause-on-leak controls, which the big providers do not give you at the same depth.

The address on your website is a spam magnet

Every business needs a public address. The website has to say something, the directories need an entry, and that address will be scraped within days of going live. Then comes the full inventory of junk: SEO agencies, fake invoice scams, list brokers, the lot.

The mistake is making that public address the same one you use for money. Put hello@ on the website, and let it take the hit. Mail to it can live behind a filter. When the noise gets bad enough, you rotate the address and update the site, while billing@ and the vendor aliases stay clean and quiet. Spam stays a nuisance in one place instead of a tax on every inbox you own. If the noise ever gets diagnostic value, why am I getting so much spam email explains how to read what the spike is telling you.

Invoice scams hit small businesses hardest

Here is the expensive version of the same story. The FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025, with losses of $3.05 billion, up from $2.77 billion the year before. The average reported loss per complaint now exceeds $122,000. That number should terrify any small business owner, because a single six-figure wire loss does not dent a small business. It ends it.

The pattern is always a vendor relationship. In February 2026, the RCMP reported that two local businesses lost tens of thousands of dollars after receiving emails that appeared to come from their suppliers, asking them to update electronic payment banking details. The suppliers' emails, police believe, had been compromised. The businesses paid the new accounts. The money went to accounts opened with fraudulent identification.

Aliases do not prevent this. I want to be straight about that, because it is the most important sentence in this section: nothing about having a clever address setup stops a scammer from sending you a convincing fake invoice. What stops it is a boring rule. Verify every payment change out of band. Phone the vendor on a number you already have. Never use the number in the email. The RCMP says exactly this.

What aliases do give you is the reverse test. You pay your paper supplier through the alias you gave them. The "new bank details" email arrives on a different address. Then you do not need to inspect headers or hover over links: if the "new bank details" email did not come through the alias that vendor knows, it did not come from the vendor. That is the one alias per site detection trick applied to invoices. The phone call still comes first. The alias is what told you to make it.

The 20-minute setup

This is the part people overthink. Do it in this order:

1. Pick your role addresses: orders@, billing@, hello@. Write them down before touching any settings, because the list is the design.
2. In Google Workspace, add them as aliases on your own account (one person) or as groups (a team). Google's docs say this is free and takes minutes, and one consultant's writeup of the alias-vs-group workaround documents the exact admin steps, including letting a group receive mail from the public internet. In Microsoft 365, add them as proxy addresses on the mailbox.
3. Set hello@ (or info@) as the public address everywhere: website, directories, invoices, signatures.
4. Give each vendor you pay regularly their own alias. How to set up an email alias walks through the mechanics; for the granular per-vendor version with pause controls, an email alias explains what the forwarding layer actually does.
5. Write the two rules down and pin them where money moves: no shared passwords on role addresses; no payment change without a phone call.

That is it. No new hire, no consultant, no IT department.

What this setup does not do

Two honest admissions, because this piece is for owners who make decisions with their own money.

First, role addresses are still single points of trust. If someone takes over your inbox, they take over every alias on it. Aliases are compartmentalisation, not authentication. Turn on multi-factor authentication on the underlying mailbox before you do any of the above. SQ Magazine's guide calls MFA the fastest win available, and it is right: it is an afternoon's work and it closes the account-takeover version of these attacks completely.

Second, this setup asks for discipline it does not enforce. Nothing stops you from handing billing@ to a vendor out of habit, or from answering a "new bank details" email without calling. The system works only as well as the person running it, which, for a small business, is you. I will take that trade over the alternative: one shared address, one shared password, and no idea who leaked what.

Run your email like the business you intend to become. Four aliases, two rules, twenty minutes. The customers will never know there is no IT department. Neither will the spammers.